3 ms·
Just checked on my Raspberry Pi, Raspbian does not yet provide a fix.
by reirob 12y ago
Just checked on my Raspberry Pi, Raspbian does not yet provide a fix.
- orblivion 12y agoI didn't get any updates on Debian yet either. From reading this: http://unix.stackexchange.com/questions/158767/which-debian-patches-fixes-shellshock-lcamtuf-cve-2014-6277-and-cve-2014-6278 http://unix.stackexchange.com/questions/158767/which-debian-... It looks like Debian may have applied something to make the attack not exploitable, even though it still segfaults. Seems weird to me, but it's the best explanation I have.
- gpvos 12y agoYou are confused. You say that you didn't get any updates on Debian, yet you say that it looks like Debian may have applied something. As I explained above, the patch for CVE-7169 by Florian Weimer made bash invulnerable to code injection by arbitrary environment variables. The underlying bugs CVE-6277 and CVE-6278 therefore have no known attack vector from outside bash, though they can still be triggered from a shell script or the command line if they are not patched. Theoretically, they could become part of a different attack, so it's wise to patch them, but there's no hurry, since as long as you or Debian have applied the abovementioned patch for CVE-7169, it means there's currently no publicly-known exploit. Also, Debian uses dash as its version of sh, so the problem can only occur if bash is called explicitly.